The Battle With cacerts and HTTPS

While trying to work through the tutorial to Journyx's Web Services (jxapi), all kinds of crap started going wrong. First off, I needed to generate the Java Code from Journyx's WSDL.

The URL that had the WSDL file was under https. When I tried to do a WSDL2Java Axis command from my command prompt, I started getting back all kinds of errors. The first problem was that when you're running Axis, all of the /lib jar files, need to be in your classpath. I fixed this by explicitly setting the SYSTEM's Environment Variables to include all of the jar files axis.jar, axis-ant.jar, commons-discovery-0.2.jar, commons-logging-1.0.4.jar, jaxrpc.jar, log4j.jar, log4j-1.2.8.jar, saaj.jar, wsdl4j-1.5.1.jar.

Problem 1 down. Next, I had to add the xercesImpl.jar file (from Xerces) to the class path. Problem 2 down. Finally I had to add the mail.jar and activation.jar files into the CLASSPATH. I had to go and download all this stuff from the Java 6 EE SDK from Sun's website. Both mail.jar and activation.jar are in /lib. I downloaded Java 6 EE from http://java.sun.com/javaee/downloads/index.jsp. I downloaded the Glassfish Java EE + JDK one.

So all the classnotfound exceptions coming from the DOS window were stopped, but instead I was getting a

java.security.cert.CertPathValidatorExcep

tion: basic constraints check failed: pathLenConstraint violated - this cert must be the last cert in the certification path

This was a bummer. I read various sites, and the first issue was that the CA Certificate that Journyx was using, was not located in my cacerts file. Basically, CA Certificates seems to be what https uses to communicate. Both the client (my code), and the server (their code), have to have this certificate included as a trusted certificate. I think that in order to make the certificate trusted, you have to place it in java's cacerts file. THIS FILE FOR ME WAS LOCATED IN 2 SEPERATE PLACES. One was at /lib/security. The other was at /jdk/jre/lib/security. This fact is important. Be warned.

Anywho, in order modify the cacerts file, you have to use Java's keytool. I hit the WSDL address directly from the browser and was able to see the WSDL in the browser. In the browser, from the WSDL, if you double click the lock icon at the bottom of your browser, and click View Certificate, you can actually see what certificates are being used by Journyx. There were 3, but I only exported the bottom one Network Solutions Certificate Authority because I am a dumbass. So I downloaded that certificate to my local machine, and using the command,

keytool -keystore \lib\security\cacerts -import -alias network -file NetworkSolutionsCertificateAuthority.cert -trustcacerts

was able to get rid of the above error.

Naturally, this caused a different error to appear. This time it was an error saying

sun.security.validator.ValidatorException: PKIX path building failed:

sun.security.provider.certpath.SunCertPathB

uilderException: unable to find valid certification path to requested target

After digging around for days, I realized that the other 2 certificates in the hierarchy from the WSDL in the browser needed to be added as well. So I followed the same steps to download those certificates and keytool them into my cacerts file. Finally I was able to generate the java using Axis's WSDL2Java command.

But wait, there's more. Probably due to how my eclipse, tomcat, and environment variables are configured, when I tried to call one of the web services the jxapi offers, login, I was encountering the same exact piece of trash error "unable to find valid certification path to requested target."

WTF said I.

The issue here, was the related to what I mentioned way at the top of this beast of a post. There are 2 cacerts files. My Dos prompt used the one at /lib/security, while Eclipse/Tomcat, used the one located at /jdk/jre/lib/security.

Once both cacerts files were the exact same, everything started working fine.

Hopefully this helps someone. It was uncool having to figure all this crap out.

This is my first post, and I can't sort out all the font crap, so forgive the length and look of this blathering. I'll pare it down to essentials on future posts. Maybe.